As well known, electronic control units (ECU) mounted on a vehicle are connected via a network and can mutually communicate information (vehicle information) possessed by the electronic control units, configure a communication system, that is, a vehicle network system, in many cases. Further, a control area network (CAN) is known as one of such vehicle network systems.
Since the CAN is configured such that each of the ECUs sharing a bus, which is a communication line, can circulate a message to the bus by determination of each ECU, it is easy to transmit the message from each ECU to the bus. Therefore, for example, an invalid ECU can be connected to the bus of the CAN to transmit an invalid message to the bus. Further, when such an invalid message is transmitted, there is a concern that the invalid message may be processed in the same manner as a regular message in the ECU receiving the invalid message.
Accordingly, in the conventional art, for example, technologies for detecting an invalid ECU transmitting an invalid message have been suggested. An example of the technology is disclosed in Patent Document 1.
In a communication system disclosed in Patent Document 1, a plurality of ECUs and one gateway are connected to a communication line in a vehicle to mutually communicate with each other. Each of the ECUs transmits a hash value of data stored in the own device to the gateway when the ignition switch is turned OFF. The gateway receiving the hash value stores the transmitted hash value of each ECU as comparison data in an EEPROM. On the other hand, each ECU starting operation at the time when the ignition switch is turned ON transmits the hash value of the stored data to the gateway. Thus, for each ECU, the gateway compares a newly transmitted hash value to the corresponding comparison data (hash value) stored in the EEPROM. Then, when it is determined that the comparison result is not identical, the data of the ECU is determined to be falsified. Thus, since the falsified ECU can be reliably detected, it is possible to eventually prevent an invalid message from being transmitted from the ECU to the bus of the CAN.